ContinuumCon Teaser: solst/ice, Zack Korman, & Spencer Alessi!!

Continuum Con (Year 2) overview / format

• Online live-stream cybersecurity conference with a strong focus on hands-on, practical workshops rather than “death by PowerPoint.”
• Ticketed access includes workshop labs/environments that attendees can keep and revisit after the event (“access forever”), not just watch recordings.
• Positioning: most value is from interactive training + capture-the-flag style practice and the ability to explore labs during and after the conference.

---

Key workshop themes (from guest speakers)

1) Zach (Zach Korman) — AI agent sandbox escape / breakout techniques

Session topic: “AI agent sandbox escapes” (breaking AI out of sandboxes).

Approach described:

• Use multiple sandbox environments (about “five” and “six” mentioned) and attempt escape/red-team style attacks.
• For each sandbox, attendees use/try AI tooling (e.g., Claude or “whatever you want”) to attempt bypasses.
• The instructor covers not only the escape itself, but how to prompt/approach the problem so the AI performs the unsafe action.
• Mentions specific environments, including something like NVIDIA’s “Nemo claw”-type sandbox (described as sandboxed/“open claw”).
• Outcomes are non-deterministic: learners may uncover additional escapes beyond what the instructor already identified.

---

2) Spencer (Spencer Alessi) — Killing Active Directory (AD) attack paths

Session topic: “killing Active Directory attack paths once and for all.”

Demonstrated attack paths:

• Pass-the-Ticket to enable lateral movement.
• PS remoting to move laterally inside Windows/AD environments.

Defensive mechanism:

• Uses authentication policies and authentication policy silos to restrict where accounts can authenticate (e.g., tier-0 accounts only from specific devices like domain controllers).
• The workshop shows that after implementing authentication policies/silos, the attack paths no longer work.

What you’ll learn (framing):

• Where AD attack paths come from, how to find them, and how to mitigate/kill them in your environment.

AD vulnerability philosophy:

• Many findings are framed as misconfigurations (with the note that what counts as a “vulnerability” depends on definitions).
• Emphasis that AD is a “deep hole” of complexity; attack surface grows as detection/recording improves.

---

3) Solstice (Solstice / “Ice” mentioned as the speaker) — Security engineering via CI/CD scanning + runtime validation + AI-assisted scanning

Session theme: how to make a product more secure (security engineering as a repeatable workflow).

Pipeline/workshop exercises centered on GitHub:

• SAST with Semgrep
  • Run scans on each pull request using GitHub Actions.
  • Configure PR comments so findings show up on the PR.
• DAST and runtime-ish validation
  • Use tools like ZAP and Nuclei (and mentions Nmap) to test what’s deployed.
  • Automate these via GitHub Actions.
• Secret scanning with TruffleHog.
• AI-assisted code scanning
  • Mentions using Claude API to scan code (AI integrated into the workflow).

Workshop interaction:

• Uses Discord for audience engagement and Q&A during the practical session.

---

Conference “access” and learning support

• Free stream access: the live streams are free (June 12–14, weekend mentioned).
• Workshop labs are behind the ticket:
  • Defender tier: 3 months access to workshop content.
  • Guardian tier: lifetime access to content/workshops/labs.
• Also mentioned:
  • VOD recordings and playlists available online (free) beyond the live stream.
  • A free CTF event associated with the conference (ticket holders get extra benefits).

---

Tech discussion highlights (Q&A segments)

• Vulnerability trend debate

  • Argument presented: vulnerabilities likely won’t decrease because:
    • More systems/code and more scrutiny (“more people looking”).
    • Better cataloging means more recorded issues.
    • Even if fixing improves, finding improves too.

• AI + Active Directory management

  • Some connectors/integrations exist (e.g., MCP-style connectors, integrations with AD management platforms),
  • Warning: AD changes can silently break things; AI might make “helpful” changes without full context.

• Home lab guidance for AD (Spencer)

  • Minimum-ish: 3 VMs (domain controller + server + workstation/victim machine).
  • Tools: VirtualBox or VMware Workstation.
  • Example resources to practice/misconfigure AD:
    • BadBlood (PowerShell script generating objects/users plus misconfigs).
    • GOAD (“Game of Active Directory”) large pre-built misconfigured environment.
  • Where to start attacking:
    • Common misconfig categories: certificate abuse, Kerberoasting, password-related issues, and Group Policy problems.
  • Also notes training alternatives: Hack The Box / TryHackMe AD modules.

---

Main speakers / sources (as identified in the subtitles)

• Anthony (host/moderator)
• John (co-host/moderator)
• Zach Korman (AI sandbox escape workshop)
• Spencer Alessi (Active Directory attack path workshop)
• Solstice (security engineering workshop; referenced as “Sol/Solstice/Ice” in subtitles)